JS:Redirector-MR in my wordpress site

[shrmony]

ht-p://www.scientiahow.com/
i know that the virus is in the theme i want to know in what file and how to remove this virus

[!Donovan]

Can you please make the link nonclickable, shrmony?

Change http to hXtp, as it avoids accidental clicks.

[shrmony]

done

[!Donovan]

Sucuri gives us some malicious links it found.


Do you know how to edit the source of your site?

[shrmony]

Sucuri gives us some malicious links it found.


Do you know how to edit the source of your site?

the infect is in the template file so it will be in all links

[!Donovan]

Alright. Can you edit your template file?

If so, do a search for p,a,c,k,e,r

And remove the code attached.

[!Donovan]

the infect is in the template file so it will be in all links

When I view your homepage, I also see this malicious script (not loaded by a secondary file), so remove it from your homepage as well.

[shrmony]

the infect is in the template file so it will be in all links

When I view your homepage, I also see this malicious script (not loaded by a secondary file), so remove it from your homepage as well.

i deleted the p,a,c,k,e,r script from the footer is there any thing else?

[!Donovan]

It appears in your 404 javascript

[shrmony]

It appears in your 404 javascript

i have deleted it now from all files i can get
thanks very much
another question
what is this virus used for ?

[!Donovan]

It's a Dead Edwards virus.

This kind of virus is packed by Dean Edwards packer, which can be found at his site.

This code attempts to load a malicious page from another site.

[Pondus]

what is this virus used for ?

as it say...JS:Redirector.....it will send you somwhere else  

and that place may have additional malware...




Sucuri info on Dean Edwards packer

http://sucuri.net/new-malware-evalfunctionpacked.html
http://sucuri.net/malware/malware-entry-mwjsdepack

and on wordpress
http://sucuri.net/?s=wordpress

[shrmony]

really thanks for you all

[!Donovan]

Your welcome!